PT-2017-7963 · Grandstream · Grandstream Wave

Publicado 2017-04-21 · Atualizado 2018-10-09 · CVE-2016-1520

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grandstream Wave app versions 1.0.1.26 and earlier

Description The issue concerns the Grandstream Wave app not using HTTPS when retrieving update information. This might allow man-in-the-middle attackers to execute arbitrary code via a crafted application.

Recommendations For Grandstream Wave app versions 1.0.1.26 and earlier, consider updating to a newer version that uses HTTPS for retrieving update information to prevent man-in-the-middle attacks.

Correção

Enumeração de Fraquezas

CWE-254

Identificadores relacionados

CVE-2016-1520

Produtos afetados

Grandstream Wave

Referências · 5

• http://securityfocus.com/archive/1/537821/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-1520 · Nota de Segurança
• https://rt-solutions.de/wp-content/uploads/2016/04/CVE-2016-1520-app-update-redirection.pdf · Nota
• https://osv.dev/vulnerability/CVE-2016-1520 · Aviso do Fabricante
• http://packetstormsecurity.com/files/136291/Grandstream-Wave-1.0.1.26-Update-Redirection.html · Nota